1 Macros supported by location

Overview

The macros supported by location table contains reference of all macros (built-in, expression, and user-definable) that are supported in the specific location.

If all macros from a related group are supported, then only the group name is given. Click each macro name or group name to see full details of the macros.

The macro details list contains a detailed list of all built-in macros, grouped by application area. Note that to customize macro values (for example, shorten or extract specific substrings), you can use macro functions.

Macros supported by location

Macro details

This list contains details for each built-in macro grouped by application area:

• Action macros
• Alert macros
• Date/time macros
• Discovery macros
• Event macros
• Event update macros
• Cause/symptom event macros
• Recovery event macros
• Escalation macros
• Function macros
• Host macros
• Target host macros
• Host group macros
• Host inventory macros
• Item macros
• Low-level discovery notification macros
• Map macros
• Proxy macros
• Script macros
• Service macros
• Trigger macros
• Username macros

Action macros

{ACTION.ID}

The numeric ID of the triggered action.

{ACTION.NAME}

The name of the triggered action.

Alert macros

{ALERT.MESSAGE}

The Default message value from action configuration.

{ALERT.SENDTO}

The Send to value from user media configuration.

{ALERT.SUBJECT}

The Default subject value from action configuration.

Date and time macros

{DATE}

The current date in yyyy.mm.dd format.

{TIME}

The current time in hh:mm:ss format.

{TIMESTAMP}

The current time in UNIX timestamp format.

Discovery macros

{DISCOVERY.DEVICE.IPADDRESS}

The IP address of the discovered device. Available always, does not depend on host being added.

{DISCOVERY.DEVICE.DNS}

The DNS name of the discovered device. Available always, does not depend on host being added.

{DISCOVERY.DEVICE.STATUS}

The status of the discovered device (UP/DOWN).

{DISCOVERY.DEVICE.UPTIME}

The time since the last change of discovery status for a particular device. For example: 1h 29m 01s. For devices with status DOWN, this is the period of their downtime.

{DISCOVERY.RULE.NAME}

The name of the discovery rule that discovered the presence or absence of device/service.

{DISCOVERY.SERVICE.NAME}

The name of the discovered service. For example: HTTP.

{DISCOVERY.SERVICE.PORT}

The port of the discovered service. For example: 80.

{DISCOVERY.SERVICE.STATUS}

The status of the discovered service (UP/DOWN).

{DISCOVERY.SERVICE.UPTIME}

The time since the last change of discovery status for a particular service. For example: 1h 29m 01s. For services with status DOWN, this is the period of their downtime.

Escalation macros

{ESC.HISTORY}

The log of previously sent notifications, their escalation step and status (sent, in progress or failed).

Event macros

{EVENT.ACK.STATUS}

The acknowledgment status of the event (Yes/No).

{EVENT.AGE}

The age of the event that triggered an action, with precision down to a second. Useful in escalated messages. For example: 9m 13s.

{EVENT.DATE}

The date of the event that triggered an action in yyyy.mm.dd format. For example: 2025.04.14.

{EVENT.DURATION}

The duration of the event (time difference between problem and recovery events), with precision down to a second. Useful in problem recovery messages.

{EVENT.ID}

The numeric ID of the event that triggered an action.

{EVENT.NAME}

The name of the event that triggered an action.

{EVENT.NSEVERITY}

The numeric value of the event severity. Possible values: 0 - Not classified, 1 - Information, 2 - Warning, 3 - Average, 4 - High, 5 - Disaster.

{EVENT.OBJECT}

The numeric value of the event object. Possible values: 0 - Trigger, 1 - Discovered host, 2 - Discovered service, 3 - Autoregistration, 4 - Item, 5 - Low-level discovery rule.

{EVENT.OPDATA}

The operational data of the underlying trigger of the problem.

{EVENT.SEVERITY}

The name of the event severity.

{EVENT.SOURCE}

The numeric value of the event source. Possible values: 0 - Trigger, 1 - Discovery, 2 - Autoregistration, 3 - Internal, 4 - Service.

{EVENT.STATUS}

The verbal value of the event that triggered an action.

{EVENT.TAGS}

A comma-separated list of event tags. Expanded to an empty string if no tags exist.

{EVENT.TAGSJSON}

A JSON array containing event tag objects. Expanded to an empty array if no tags exist.

{EVENT.TAGS.<tag name>}

The event tag value referenced by the tag name. A tag name containing non-alphanumeric characters (including non-English multibyte-UTF characters) must be double quoted. Quotes and backslashes inside a quoted tag name must be escaped with a backslash.

{EVENT.TIME}

The time of the event that triggered an action in hh:mm:ss format. For example: 12:57:53.

{EVENT.TIMESTAMP}

The UNIX timestamp of the event that triggered an action.

{EVENT.VALUE}

The numeric value of the event that triggered an action. Possible values: 1 - problem, 0 - recovering.

Cause/symptom event macros

{EVENT.CAUSE.ACK.STATUS}

The acknowledgment status of the cause event (Yes/No). Used in the context of a symptom event.

{EVENT.CAUSE.AGE}

The age of the cause event, with precision down to a second. Useful in escalated messages. Used in the context of a symptom event.

{EVENT.CAUSE.DATE}

The date of the cause event in yyyy.mm.dd format. Used in the context of a symptom event.

{EVENT.CAUSE.DURATION}

The duration of the cause event (time difference between problem and recovery events), with precision down to a second. Useful in problem recovery messages. Used in the context of a symptom event.

{EVENT.CAUSE.ID}

The numeric ID of the cause event. Used in the context of a symptom event.

{EVENT.CAUSE.NAME}

The name of the cause event. Used in the context of a symptom event.

{EVENT.CAUSE.NSEVERITY}

The numeric value of the cause event severity. Possible values: 0 - Not classified, 1 - Information, 2 - Warning, 3 - Average, 4 - High, 5 - Disaster. Used in the context of a symptom event.

{EVENT.CAUSE.OBJECT}

The numeric value of the cause event object. Possible values: 0 - Trigger, 1 - Discovered host, 2 - Discovered service, 3 - Autoregistration, 4 - Item, 5 - Low-level discovery rule. Used in the context of a symptom event.

{EVENT.CAUSE.OPDATA}

The operational data of the underlying trigger of the cause problem. Used in the context of a symptom event.

{EVENT.CAUSE.SEVERITY}

The name of the cause event severity. Possible values: Not classified, Information, Warning, Average, High, Disaster. Used in the context of a symptom event.

{EVENT.CAUSE.SOURCE}

The numeric value of the cause event source. Possible values: 0 - Trigger, 1 - Discovery, 2 - Autoregistration, 3 - Internal. Used in the context of a symptom event.

{EVENT.CAUSE.STATUS}

The verbal value of the cause event. Used in the context of a symptom event.

{EVENT.CAUSE.TAGS}

A comma-separated list of cause event tags. Expanded to an empty string if no tags exist. Used in the context of a symptom event.

{EVENT.CAUSE.TAGSJSON}

A JSON array containing cause event tag objects. Expanded to an empty array if no tags exist. Used in the context of a symptom event.

{EVENT.CAUSE.TAGS.<tag name>}

The cause event tag value referenced by the tag name. A tag name containing non-alphanumeric characters (including non-English multibyte-UTF characters) must be double quoted. Quotes and backslashes inside a quoted tag name must be escaped with a backslash. Used in the context of a symptom event.

{EVENT.CAUSE.TIME}

The time of the cause event in hh:mm:ss format. Used in the context of a symptom event.

{EVENT.CAUSE.TIMESTAMP}

The UNIX timestamp of the cause event. Used in the context of a symptom event.

{EVENT.CAUSE.UPDATE.HISTORY}

The log of cause problem updates (acknowledgments, etc). Used in the context of a symptom event.

{EVENT.CAUSE.VALUE}

The numeric value of the cause event Possible values: 1 - Problem, 0 - Recovering. Used in the context of a symptom event.

{EVENT.SYMPTOMS}

The list of symptom events. Includes the following details: host name, event name, severity, age, service tags and values. This macro is used in the context of the cause event and returns information about symptom events.

Recovery event macros

{EVENT.RECOVERY.DATE}

The date of the recovery event in yyyy.mm.dd format.

{EVENT.RECOVERY.ID}

The numeric ID of the recovery event.

{EVENT.RECOVERY.NAME}

The name of the recovery event.

{EVENT.RECOVERY.STATUS}

The verbal value of the recovery event.

{EVENT.RECOVERY.TAGS}

A comma-separated list of recovery event tags. Expanded to an empty string if no tags exist.

{EVENT.RECOVERY.TAGSJSON}

A JSON array containing recovery event tag objects. Expanded to an empty array if no tags exist.

{EVENT.RECOVERY.TIME}

The time of the recovery event in hh:mm:ss format.

{EVENT.RECOVERY.TIMESTAMP}

The UNIX timestamp of the recovery event.

{EVENT.RECOVERY.VALUE}

The numeric value of the recovery event.

Event update macros

{EVENT.UPDATE.ACTION}

Human-readable name of the action(s) performed during problem update. Resolves to the following values: acknowledged, unacknowledged, commented, changed severity from (original severity) to (updated severity) and closed (depending on how many actions are performed in one update).

{EVENT.UPDATE.ACTIONJSON}

A JSON array containing details of the action(s) performed during problem update. Possible JSON property values: - true (for acknowledge, unacknowledge, close, unsuppress, cause, and symptom properties); - <message string> (for message property); - timestamp (for suppress_until and timestamp properties) or 0 (for suppress_until property if suppressed indefinitely); - 0, 1, 2, 3, 4, 5 (for old and new severity properties).

For example: {“acknowledge”:true,“message”:“Monthly maintenance.”,“severity”:{“old”:2,“new”:1},“suppress_until”:1730851199,“timestamp”:1730822048}

{EVENT.UPDATE.DATE}

The date of the event update (acknowledgment, etc) in yyyy.mm.dd format. {ACK.DATE} is deprecated and may not resolve in supported locations.

{EVENT.UPDATE.HISTORY}

The log of problem updates (acknowledgments, etc). {EVENT.ACK.HISTORY} is deprecated and may not resolve in supported locations.

{EVENT.UPDATE.MESSAGE}

The problem update message. {ACK.MESSAGE} is deprecated and may not resolve in supported locations.

{EVENT.UPDATE.NSEVERITY}

The numeric value of the new event severity set during problem update operation.

{EVENT.UPDATE.SEVERITY}

The name of the new event severity set during problem update operation.

{EVENT.UPDATE.STATUS}

The Numeric value of the problem update status. Possible values: 0 - Webhook was called because of problem/recovery event, 1 - Update operation.

{EVENT.UPDATE.TIME}

The time of the event update (acknowledgment, etc) in hh:mm:ss format. {ACK.TIME} is deprecated and may not resolve in supported locations.

{EVENT.UPDATE.TIMESTAMP}

The UNIX timestamp of the event update (acknowledgment, etc)

Function macros

{FUNCTION.VALUE}

The value of the Nth item-based function in the trigger expression at the time of the event. Only functions with `/h

（本文超出站点单文档体积上限，已截断）